tracing: Check total refcount before releasing bufs in profile_enable failure

When we call the profile_enable() callback of an event, we release the
shared perf event tracing buffers unconditionnaly in the failure path.
This is wrong because there may be other users of these. Then check the
total refcount before doing this.

Reported-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Li Zefan <lizf@cn.fujitsu.com>

1 files changed, 10 insertions, 5 deletions

diff --git a/kernel/trace/trace_event_profile.c b/kernel/trace/trace_event_profile.c
index dd44b8768867..e52784b7b844 100644
--- a/kernel/trace/trace_event_profile.c
+++ b/kernel/trace/trace_event_profile.c
@@ -31,7 +31,7 @@ static int ftrace_profile_enable_event(struct ftrace_event_call *event)
         if (atomic_inc_return(&event->profile_count))
                 return 0;
 
-        if (!total_profile_count++) {
+        if (!total_profile_count) {
                 buf = (char *)alloc_percpu(profile_buf_t);
                 if (!buf)
                         goto fail_buf;
@@ -46,14 +46,19 @@ static int ftrace_profile_enable_event(struct ftrace_event_call *event)
         }
 
         ret = event->profile_enable();
-        if (!ret)
+        if (!ret) {
+                total_profile_count++;
                 return 0;
+        }
 
-        kfree(trace_profile_buf_nmi);
 fail_buf_nmi:
-        kfree(trace_profile_buf);
+        if (!total_profile_count) {
+                kfree(trace_profile_buf_nmi);
+                kfree(trace_profile_buf);
+                trace_profile_buf_nmi = NULL;
+                trace_profile_buf = NULL;
+        }
 fail_buf:
-        total_profile_count--;
         atomic_dec(&event->profile_count);
 
         return ret;